Removing Malware from Windows Vista (part 1) - Understanding Common Malware Issues

Regardless of the goal, as a Consumer Support Technician, your advice can help users keep their computers clear of malicious software. In the event that malware infections do occur, you’ll need to know how to remove them. Fortunately, Windows Vista includes numerous features that are helpful in detecting and removing malware. In this lesson, you’ll learn ways in which you can diagnose and remove malware.

Understanding Common Malware Issues

One of the unique challenges that you’ll face as a Consumer Support Technician is that of dealing with software that you have likely never seen before. Before you can adequately defend a computer against typical types of malware, you must first understand issues related to how malware works. Often, understanding the methods by which spyware and other unwanted software is installed can be a good start. Additionally, recognizing the effects of malware installations can be helpful in quickly diagnosing and troubleshooting problems. In this section, you’ll learn about malware and how it works.

Types of Malware

There are numerous different types of malware that can be installed on users’ computers. Although each type of malware has some unique characteristics, all of these types of programs have one thing in common: they perform unwanted actions on the user’s computer. Examples of types of malicious software include the following:

• Spyware The fundamental purpose of spyware is to monitor and collect information from the computer on which it is installed. For example, a spyware program might keep track of which files you open or even record the typing of logon information and passwords. The spyware can then transmit this information to other computers over the Internet. For example, an individual or organization might attempt to create databases of users’ credit card information or passwords.

• Adware Advertising is almost unavoidable on the Internet, but users are fairly familiar with encountering it when visiting Web sites. The revenue obtained from placing ads often helps support the creation and distribution of the content. Adware, on the other hand, is designed to be installed on a computer to present commercial advertisements. This might take the place of random pop-up ads that appear whether or not the user is using a Web browser or other Internet tool.

• Viruses Viruses are malicious software programs that have the ability to spread. The virus code itself can perform a wide variety of different functions. Some are annoying, such changing system settings or displaying unwanted messages on the computer. Others can be completely devastating and can target specific files or entire hard disks. Like biological viruses, they tend to multiply and spread to other computers in a network environment. For example, a virus might automatically detect other computers in a small-business environment and copy itself to those computers.

• Root kits This type of unwanted software is designed to access a computer and then gain full permissions on it. These are sometimes referred to as Trojan horses, in reference to the story from Greek mythology. After the program is able to run with complete access to the system, it can either perform specified instructions or carry out operations that might be sent over the Internet. Root kit infections can often do extensive damage to the local computer.

• Other unwanted software There are numerous other types of software that perform malicious or unwanted actions. In many cases, these programs are included as part of an Internet download. Sometimes, licensing agreements provide a limited description of the purpose of the program. In other cases, there is no warning whatsoever that the additional software is being installed. Regardless of the way in which these programs are installed, most users would want to remove them.

One important point to keep in mind is that the definition of which software is truly malware might be subjective. A few programs might have legitimate uses that appeal to a relatively small number of computer users. Perhaps a “free” Internet program might require users to install additional software to use the product legally. In these cases, users might choose to keep the installed software on their computers. Later in this lesson, you’ll see ways in which users can identify and remove potential malware.

Sources of Malware

The original source of the installation of malware can include many different avenues. Examples include the following:

• Software installations Some software products include additional functionality that might perform unwanted actions on the computer. This is often true of programs downloaded from the Internet. For example, a screen saver or other product might be available at no charge, but the program itself might include the installation of software that randomly displays advertisements on the user’s computer, or the program itself might collect and transmit information without requiring the user’s consent.

• Web sites Internet Web sites can contain a large number of different types of files and content that can affect the local computer. Usually, reputable Web sites clearly inform users before they install new programs on users’ computers. In some cases, however, malicious sites can make changes to browsers and operating systems, resulting in the installation of malware.

• Data files It is possible for office productivity files to include viruses or other malicious content. For example, documents created using Microsoft Office can contain macros, sets of programmatic code that can perform a wide array of operations. Macros can be configured to access other files on the computer and make system changes. Although Microsoft Office contains numerous safeguards against these types of operations, users can disable these safeguards and leave their machines vulnerable.

• E-mail The presence of unsolicited commercial bulk e-mail (also known as spam) is extremely common among Internet users. Malicious e-mail messages might include attachments that, when installed on the computer, can cause data loss or reduced performance.

Unfortunately, new types of malware are continually being developed. Often, the user is required to take some kind of action, but he or she might do so based on limited knowledge of the exact effects of the program.

Effects of Malware Installation

After malware is installed on users’ systems, a wide range of different actions can be performed, including the following:

• Changes to system or application settings (such as the configuration of the Internet Explorer home page or toolbars).

• Changes to application behavior. For example, a command or function that used to perform one task might now redirect the user to a specific Web site.

• The addition of new programs or features on the computer. This can often be seen in new programs that appear in the Start menu or that automatically load when a user logs on to the computer.

• System performance slowdowns. Examples include general application performance decreases and increased startup times for the operating system. Users might also notice significant hard disk or network activity that cannot be explained based on user activity.

• The automatic display of advertisements even when the user is not actively using the Internet.

It is important to note that sophisticated malware developers can be considerably clever when designing their products. Some of the most malicious pieces of software might work without providing any noticeable effects on the computer. Therefore, the absence of any of the symptoms just listed does not necessarily imply that the computer is free of malware. Regardless, it is important to remove malicious and unwanted software from customers’ computers quickly.

Real World

Anil Desai

Although you cannot reasonably prevent some types of malware infections without the use of additional detection and removal software, you can prevent many of them through user education. A common method by which malware is installed on computers is by tricking users. Operating systems such as Windows Vista and Internet-enabled applications such as Internet Explorer include numerous security-related features that attempt to warn users of the potential dangers of installing a new application. Although this can help reduce the frequency of malware installations, it cannot protect users from themselves. For example, if a customer believes that he or she can dramatically improve system performance by downloading and installing an application, the user is very likely to ignore or bypass any warnings.

It is tempting to blame users for most of these actions, but there are also cases in which it is understandable that someone would be fooled by malware authors. After all, it is the business of these authors to dupe unsuspecting visitors to Web sites and other locations. How can you help prevent these problems? The best approach is end-user education. Here are some useful pointers to provide to customers in an effort to reduce the likelihood of unwanted software installation:

• Consider the source When shopping in the physical world, individuals often have a way of determining the validity of a claim or a vendor. On the Internet, it’s much more difficult to do the same. In general, users should be suspicious of exaggerated claims and programs that are available “completely free.” They should ask themselves why a company would offer this product and how the company benefits. Often, the inclusion of adware or spyware is the answer.

• Don’t be too trusting Malware vendors are experts at building Web sites that appear to be reputable. They might use other organizations’ logos and ask for private information. In general, users should avoid giving out personal information or details like credit card numbers unless they are sure of the source of the request. Often, official e-mail messages include details such as the user’s account number to help ensure its authenticity.

Although the presence of malware will continue for the foreseeable future, it’s important for Consumer Support Technicians to realize that technology is only one part of the solution. By educating the users you support, you can help reduce this deceptive business practice and the harm that it can cause. It can also help give you more time to focus on other, more interesting, technical challenges!